Carl Bruiners Agile / IT Development Consultant

Personal online security

I've spent a lot time working on security projects, ranging from securing personal child information to PCI / DSS credit / debit card security.

I also spent time advising a steering group on social media behaviour and recently I had to give a lecture to a family member on what not to do online.

In the modern world of the web, social media / social sharing is making it even easier for a would-be hacker to obtain data to compromise your integrity.

Things to remember;

• Don't use your real name. Try obfuscating your true name; use a nickname instead of your real name
• Use your date of birth as your pin number or a mixture of birthdays (partner and your day or month or year, I managed to disarm a relatives alarm just by trying two combinations of their birth of date)
• Try hiding your family members you are linked too on your social sites (Facebook, Twitter, etc..), a lot of security identification methods use mothers maiden names
• If you have to leave a phone number on a public site / social media site use a mobile and not a landline number, ideally don't leave any contact telephone / fax number
• Keep pictures secure on social media sites, don't share with everyone

Using some of the points above I'll reverse these and give you an example of how easy it is to access account details and change them;

You accept an anonymous friend request on a social networking site, once accepted this 'new' friend can see your relatives (scanning your friends list with the same surname), your mobile phone number and your date of birth (information area). Your new friend rings your mobile a few times until they get through to your voicemail which announces the carrier you use. Your new friend now rings up the carrier, and they ask for personal identification; your name, your date of birth and your mothers maiden name. Your new friend now adds a second line to your account and requests the SIM card be sent to an alternative address, your new friend runs up hundreds of dollars on your mobile account over a period of a month. Like most bills, you don't receive a paper copy of the bill and you only notice that there is a problem once your current account has been debited and left you no money to pay your rent / mortgage, school fee's, etc... Now imagine trying to prove to your mobile phone carrier that you didn't set up the additional line and explaining to your other bills you cannot afford to pay.

The example above is relatively mild in terms of damage a 'would be' hacker could achieve. I have many friends who I could create new credit accounts; banks, credit cards, etc... based on data publicly visible on social networks. The possibilities of damage is endless; fake passports, access to personal accounts, etc...